1. 1 Kyung Hee University Prof. Choong Seon HONG Network Monitoring

2. 2 Kyung Hee University Network Monitoring  Access to monitored information How to define monitoring information, and how to get that information from a resource to a manager  Design of monitoring mechanisms How best to obtain information from resources  Application of monitored information How the monitored information is used in various management functional areas

3. 3 Kyung Hee University Network Monitoring Information  Information type Static : infrequent changing information. Ex) Port ID, Number of Ports l Not frequently changed Dynamic : state information. Ex) state of protocol machine or the transmission of packet Statistical : derived from dynamic information. Ex) average number of packets transmitted

4. 4 Kyung Hee University Network Monitoring Information (cont’d)  Organization of a management information base by Mazumdar and Lazar(1991) Call_Blocked Packed_Loss Time_Delay Throughput State_Variable Event_Variable Switch_Server Buffer Source Station _info Server Switch_Buffer Switch_Source Status_Sensor Derived_Status_sensor Event_Sensor Configuration DB Sensor DB Sensor activation and data collection Abstraction of state and event variables Statistical DB Dynamic DB Static DB

5. 5 Kyung Hee University Network monitoring configurations  Monitoring application : visible to user such as performance monitoring, fault monitoring and accounting monitoring  Manager function : having basic monitoring function  Agent function : gathering and recording management information from one or more elements, and communicate with monitor  Managed objects : management information that represents resources and their activities  Monitoring agent : generating summaries and statistical analyses of management information

6. 6 Kyung Hee University Network monitoring configurations (cont’d)  Functional architecture for network monitoring Monitoring application Manager function Agent function Managed object Monitoring application Manager function Monitoring agent Agent function Managed object Agent function Managed object Manager-agent model A model for summarization

7. 7 Kyung Hee University Network monitoring configurations (cont’d) Monitoring application Manager function Agent function Managed objects Monitoring application Manager function Agent function Managed object Subnetwork or Internet Monitoring application Manager function Subnetwork or Internet Agent function LAN Observed traffic Monitoring application Manager function Subnetwork or Internet Agent function LAN Proxy monitor agent External monitor Managed resources in manager system Resources in agent system

8. 8 Kyung Hee University Polling and event reporting  Information is collected and stored by agents and it is used by multiple managers  Two techniques to make the information polling : request-response interaction between a manager and agent l querying any agent and requesting the values of various information elements l agent responding with information from its MIB event reporting : initiative with the agent and the manager with the role of a listener l giving current status of agent to manager l preconfigurable reporting period or settable by manger l generating a report when a significant event (ex, a change of state or an unusual event (ex., fault) l more efficient than polling for monitoring object whose states or values change relatively infrequently

9. 9 Kyung Hee University Polling and event reporting (cont’d)  Telecommunications management system : very high reliance on event reporting  SNMP approach puts very little reliance on event reporting  SNMP and OSI systems management

10. 10 Kyung Hee University Performance monitoring  Performance indicators absolute prerequisite for the management of telecom network : measuring the performance of the network, or performance monitoring difficulties to choose appropriate indicators because of following: l there are too many indicators in use l the meanings of most indicators are not yet clearly understood l some indicators are introduced and supported some manufacturers only l most indicators are not suitable for comparison with each other l frequently, the indicators are accurately measured but incorrectly interpreted l in many cases, the calculation of indicators takes too much time, and the final results can hardly be used for controlling the environments service-oriented measures (availability, response time, accuracy) and efficiency-oriented measures (throughput, utilization)

11. 11 Kyung Hee University Performance monitoring (cont’d)  Availability : percentage of time that a network system component, or application is available for a user A = MTBF / MTBF + MTTR, where MTBF : mean time between failures, MTTR : mean time to repair Availability of serial and parallel connections AA A2A2 A A 2A - A 2 Serial Parallel 0.98 x 0.98 = 0.96 1- 0.98 = 0.02 : one unavailability 0.02 x 002 =0.0004 : both unavailability 1-0.004 = 0.9996: availability of combined unit

12. 12 Kyung Hee University Performance monitoring (cont’d)  Response time Several studies show that a computer and a user interacts at a pace that neither has to wait on the other l productivity increases significantly l the cost of work drops l quality tends to improve Up to two seconds : it was acceptable for most interactive applications User response time: the time span between the moment a user receives a complete reply to one command and enters the next command - referred to as think time System response time: the time span between the moment the user enters a command and the moment a complete response is displayed

13. 13 Kyung Hee University Performance monitoring (cont’d)  Elements related to response time Inbound terminal delay : the delay in getting an inquiry from terminal to the communications line Inbound queuing time : the time required for processing by the controller or PAD device Inbound service time : the time to transmit the communications link and nodes (controller to host’s front-end processor) Processor delay : the time for processing in the front-end processor, the host processor, the disk driver and so on Outbound queuing time : the time a reply spends at a port in the front- end processor waiting to be dispatched to the network. Outbound service time : the time to transmit the communications facility from the host’s front-end processor to the controller. Outbound terminal delay : primarily due to line speed

14. 14 Kyung Hee University Performance monitoring (cont’d)  Elements of response time TI = inbound terminal delay WI = inbound queueing time SI = inbound service time CPU =CPU processing delay WO = outbound queueing delay SO = outbound service time TO = outbound terminal delay Network Server Network interface (e.g., bridge) PC TI WI SO WO CPU SI TO

15. 15 Kyung Hee University Performance monitoring (cont’d)  Accuracy Accurate transmission of data between user and host or between two hosts using error-correction mechanisms in protocol such as the data link and transport protocols generally not user concern rejection rate: the percentage of time the network cannot transfer information because of a lack of resources and performance – > 2% indicates significant problems  Throughput an application-oriented measure l the number of transactions of a given type for a certain period of time l the number of customer sessions of a given application during a certain period of time l the number of calls for a circuit-switched environment

16. 16 Kyung Hee University Performance monitoring (cont’d)  Goodput the probability or the rate of successfully received packets with no packet loss that causes packet loss at the receiver  Utilization a more fine-grained measure than throughput determining the percentage of time that a resource is in use over a given period of time to search for potential bottlenecks and areas of congestion usually increasing exponentially as the utilization of a resource increases (see figure 2.10)

17. 17 Kyung Hee University Performance monitoring (cont’d)  Collecting utilization data On a bridge or router l packet forwarding rate l percentage of dropped frames (on each interface) l number of packets in a queue l processor load On a file server l processor load l disk access rate l NIC utilization

18. 18 Kyung Hee University Performance monitoring (cont’d)  Network Management System A simple tool l provide real-time information about network devices and links l preferably in graphical form such as a line or bar graph A more complex tool l setting thresholds can trigger a subsequent action Time(sec) 60 50 40 Utilization (%) Threshold for alarm: 60% Rearm alarm at 40%

19. 19 Kyung Hee University Performance monitoring (cont’d) Thresholds have a priority (low, medium, high) Graphing historical data – line graph:examining trends in data such as utilization – bar graph: comparing values – pie graph: demonstration the percentage of values 100 Utilization (%) Time (seconds) 1/98 2/98 3/98 Line graph Bar graph Pie graph Memory used (Kbytes) Packets passed (K) 21% Appletalk 35% IP 29% DECnet 5% OSI 4% unknown 6% SNA

20. 20 Kyung Hee University Performance monitoring (cont’d) An Advanced tool l Examining the historical data – receive the state of the network and performance problems – retrieve information from the database – analyze the state of the network Computed actual utilization Predicted utilization 60 Utilization (%) 30 60 90 120 150 180 Time (days) Threshold value

21. 21 Kyung Hee University Performance Management l Simulating the network – analyze future performance and determine what configuration can produce the greatest performance – build the network model how the simulation should calculate each component how it should react to the simulation – Queuing analysis Server Waiting line (queue) Dispatching discipline Departure Service time Utilization Waiting time in the queue Waiting time in the queuing system

22. 22 Kyung Hee University Performance Management predicting response time, rejection rate and availability l sufficient input l simulate traffic Response time 4 sec 8 sec 12 sec 0.2 0.4 0.6 0.8 system load (utilization) Projected response time Actual response time Limit of experience

23. 23 Kyung Hee University Performance Management  Reporting performance information text reports are the most common way l utilization and error rates l network devices and links data in either a graphical format or on a bitmapped display

24. 24 Kyung Hee University Fault Management  Problems of Fault Monitoring Fault observation l unobservable faults (e.g. the existence of deadlock) l partially observable faults (e.g. failure of some low-level protocol in an attached device) l uncertainty in observation (e.g. Lack of response) Fault diagnosis l multiple potential causes l too many related observation l interference between diagnosis and local recovery l absence of automated testing tools

25. 25 Kyung Hee University Fault Management Propagation of failure to higher layers Mux Transmission break Router Client Application failure Transport failure Data link failure

26. 26 Kyung Hee University Fault Management Examples of test that a fault monitoring should have l connectivity test l data integrity test l protocol integrity test l data saturation test l connection saturation test l response time test l loopback test l function test l diagnosis test

27. 27 Kyung Hee University Accounting Management  Accounting monitoring Keep track of user’s usage of network resources Resources l communication facilities: LANs, WANs, leased lines, dial-up lines, and PBX systems l computer hardware: workstations and servers l software and systems: applications and utility software in servers, a data center, and end user sites l services: includes all commercial communications and information services available to network users Accounting data l user identification l receiver l number of packets l resources used l time stamps & priority level

28. 28 Kyung Hee University Accounting Management  Determining network resource usage total number of transaction l number of logins total number of packets total number of bytes (reflecting bandwidth) l billing on output l bytes received – Email – Acknowledgment Security level

29. 29 Kyung Hee University Accounting Management  Accomplishing Accounting Management Gathering data about the utilization of network resources Using metrics to help set usage quotas Billing users for their network use  Metrics and Quotas SNMP l RFC 1272 “Internet Accounting Background” l define services to be metered and usage reporting l define the types of information necessary at various layers Metrics work with quotas  Billing One-time installation fee Monthly fee Fee based on amount of network resources consumed

30. 30 Kyung Hee University Accounting Management  Network management system A simple tool l monitor for metrics that exceed quotas l report that data A more complex tool l perform network billing l determine where to poll for billing information An advanced tool l forecast the need for network resources l establish reasonable metrics and quotas l predict their billing costs  Reporting real-time display:the current value of a metric text reports: historical accounting and billing information